EUVD-2026-97908

Nginx UI: MCP nginxconfigadd Bypasses Directive Validation — Authenticated RCE...

CVE-2026-84318

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-84318

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-84318 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-84318 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-84318 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-84318: Protection Mechanism Failure

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-107809

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-107809

Nginx UI , a web interface for the Nginx web server, is vulnerable to Cross-Site Request Forgery (CSRF) in versions 2.0.0 through 2.5.0 . The root cause is that the AuthRequired mechanism accepts a browser-managed token cookie as an API credential after the front end stores a JWT in that cookie. ...

CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-107809 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-107809

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

EUVD-2026-95892

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-107809: Cross-Site Request Forgery (CSRF)

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

PT-2026-110952

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0-rc.6 through 2.4.0 Description An authenticated attacker can bypass the security layer by using the nginx config add MCP tool to write configuration files to disk and trigger a reload. This occurs because the tool fails...